Issue with Validation OVH

anedalux · April 20, 2026, 1:06pm

Still Cannot activate my pro liscence! is there a workarround or are you working on it?

i tried with previous version [6.7.13] and Latest Version [6.8.5]

The Error i get:

Array
(
    [headers] => WpOrg\Requests\Utility\CaseInsensitiveDictionary Object
        (
            [data:protected] => Array
                (
                    [date] => Mon, 20 Apr 2026 13:05:03 GMT
                    [content-type] => text/html; charset=UTF-8
                    [accept-ch] => Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
                    [cf-mitigated] => challenge
                    [critical-ch] => Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
                    [cross-origin-embedder-policy] => require-corp
                    [cross-origin-opener-policy] => same-origin
                    [cross-origin-resource-policy] => same-origin
                    [origin-agent-cluster] => ?1
                    [permissions-policy] => accelerometer=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=(self)
                    [referrer-policy] => same-origin
                    [server-timing] => chlray;desc="9ef45bbc5bfb9f7b"
                    [x-content-type-options] => nosniff
                    [x-frame-options] => SAMEORIGIN
                    [report-to] => {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=oqTFhtH6OpS3e9Ww0Un%2FEQ7YVXLhfU7lPcLABVyj4cf%2BRT533B8W1ewE%2BY9n5X5YxYQfuK5XwOuSHUbAQHriGAlN%2Fv6g6q%2BBYeSazfZPpQJr%2F%2BEK%2BeBvzKm8xg%3D%3D"}]}
                    [nel] => {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
                    [content-encoding] => gzip
                    [server] => cloudflare
                    [cf-ray] => 9ef45bbc5bfb9f7b-AMS
                    [alt-svc] => h3=":443"; ma=86400
                )
        )
    [body] =>

charlie · April 20, 2026, 1:10pm

Try again, we’re trying to update things on our end.

anedalux · April 20, 2026, 1:11pm

Hi @charlie, still nothing, same issue

charlie · April 20, 2026, 1:13pm

What server host are you using?

anedalux · April 20, 2026, 1:14pm

OVH @charlie

anedalux · April 20, 2026, 1:17pm

It looks like the PHP requests made by the theme to your endpoints are being interpreted by Cloudflare (likely used by your endpoints, such as https://demo.theme.co/designcloud/wp-json/design-cloud/v3/index
as bot traffic. @charlie

charlie · April 20, 2026, 1:25pm

I’ve disabled all Cloudflare security for those endpoints already. You might be getting a cache so just keep trying.

anedalux · April 20, 2026, 1:31pm

If I provide my IP address, could you verify whether it has been temporarily blocked or rate-limited by Cloudflare due to repeated test requests?

I’m consistently experiencing failures where the activation request is blocked by a Cloudflare challenge. @charlie

anedalux · April 20, 2026, 1:38pm

@charlie all my OVH based Websites dont get the update to the 6.8.5

anedalux · April 20, 2026, 2:42pm

i add my ip @charlie

charlie · April 20, 2026, 2:53pm

Contact your host, that IP is apparently being used for fraud.

anedalux · April 20, 2026, 3:40pm

Hi but my direct IP is not listed, i double checked with OVH and UCEPROTECT is listing the entire Subnet and not my Direct IP

Like this all IP in that Subnet would not work. in my case since i use OVH all my OVH website (6) will not work and will not receive updates.

i am using Themeco for 4 years and i never had that kind of problem they all came out all at once.

Here its an explaination:
" As you should know now: It is not you, it is your complete provider which got UCEPROTECT-Level 3 listed.
Your IP 5.135.23.164 was NOT part of abusive action, but you are the one that has freely chosen your provider.
By tolerating or ignoring that your provider doesn’t care about abusers you are indirectly also supporting the global spam with your money.
Seen from this point of view, you really shouldn’t wonder about the consequences."

can you please correct that? @charlie

thank you

anedalux · April 20, 2026, 3:52pm

My proivider answered me that this UCEPROTECT is asking for money to be delisted as ransom.

here is the complete link:

@charlie

charlie · April 20, 2026, 7:27pm

Why don’t you try again. Are you sure you are sending us the right server IP?

anedalux · April 21, 2026, 7:21am

I just tryed again:

Still have the same issue with:

Array
(
    [headers] => WpOrg\Requests\Utility\CaseInsensitiveDictionary Object
        (
            [data:protected] => Array
                (
                    [date] => Mon, 20 Apr 2026 19:47:34 GMT
                    [content-type] => text/html; charset=UTF-8
                    [accept-ch] => Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
                    [cf-mitigated] => challenge
                    [critical-ch] => Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
                    [cross-origin-embedder-policy] => require-corp
                    [cross-origin-opener-policy] => same-origin
                    [cross-origin-resource-policy] => same-origin
                    [origin-agent-cluster] => ?1
                    [permissions-policy] => accelerometer=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=(self)
                    [referrer-policy] => same-origin
                    [server-timing] => chlray;desc="9ef6a95f6fb8d08a"
                    [x-content-type-options] => nosniff
                    [x-frame-options] => SAMEORIGIN
                    [report-to] => {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=yjs4WBIKElc7yo053x6ZKYTmJABfoz%2FyIXettEl8WNmnvEFdJtmGcS5xfpNP5AUO%2Fgor2KRj0XbBFXyLjk5Z8sdhZhUtR3hSVtQ4sprqo44XHtZ%2BHa2JGv8GRA%3D%3D"}]}
                    [nel] => {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
                    [content-encoding] => gzip
                    [server] => cloudflare
                    [cf-ray] => 9ef6a95f6fb8d08a-CDG
                    [alt-svc] => h3=":443"; ma=86400
                )

        )

    [body] =>

I also can’t install any for your tools from my other WP sites i’m locked out everywhere.

@charlie Thank you

anedalux · April 21, 2026, 7:25am

Hi @charlie,
in secure note the mail i received from OVH.
Please let me know.
Best,

Thaelys · April 21, 2026, 9:49am

Hello,
i’m having the same issue. I’m with OVH too.

I had the critical error thing and updated all my websites accordingly. Other websites are fine now, but i still get the issue now that i try to insert a licence on a new website.
It’s the same since yesterday.

The validation request does not seem to fail because of an invalid key, but because the request is being challenged by Cloudflare on your side.

Here is the relevant response detail returned by WordPress:

content-type: text/html; charset=UTF-8
cf-mitigated: challenge
server: cloudflare

This suggests the outbound validation request from our WordPress server reaches your infrastructure, but receives a Cloudflare challenge page instead of the expected API response.

Could you please check whether our server IP is being challenged/blocked by Cloudflare on your validation endpoint, and whitelist or adjust the rule if needed?

Thank you.

charlie · April 21, 2026, 12:57pm

Try again today. Maybe we fixed it.

anedalux · April 21, 2026, 12:59pm

Yeeees!!!

thank you @charlie,

awesome job to the team.

hope it wont happend again.

Best,

Andrea Gorla

prakash_s · April 21, 2026, 1:22pm

You are most welcome, Andrea.